Mobile and the Ghostdex wallet
Ghostdex runs on a phone as an app: a signed APK on Android, or added to the home screen from Safari on iPhone. Phones have no wallet extension, so Ghostdex carries its own self-custody wallet, the Ghostdex wallet. It lives on your device and signs only after you confirm.
Install it
- 1Android
Open ghostdex.app/app/download and tap Download the APK. Open the file, allow your browser to install apps if Android asks, then tap Install. Android 7.0 or later.
- 2iPhone
Open ghostdex.app in Safari, tap Share (under the ••• button on recent iOS), then Add to Home Screen. Ghostdex opens full screen from the home screen.
- 3Create or import a wallet
On the Wallet tab, create a new wallet or import a recovery phrase or a private key, then choose a passcode.
Ghostdex is not on the App Store or Google Play. Install it only from ghostdex.app.
The Android app
The APK is a native shell around ghostdex.app/app. What you see, quote and sign is the live site, so a fix on the site reaches the app without a new download. Links to other sites, such as X or a block explorer, open in your browser. The back button walks back through the app and closes it on the first screen.
- Package
app.ghostdex.mobile, signed with the Ghostdex release key. The download page lists the file's SHA-256 and the signing certificate's SHA-256, so you can check the file before you install it. - A newer APK installs over the old one and keeps your wallet, because both carry the same signature. An APK signed by anyone else cannot replace it.
- The encrypted wallet and your agents are stored inside the app. Uninstalling it erases them; the funds stay on the chain and your recovery phrase brings them back.
- If you would rather not sideload, open ghostdex.app in Chrome and choose Install app from the menu. You get the same app as a home screen shortcut.
The iPhone app
On iPhone, Ghostdex installs from Safari as a home screen app. It opens full screen, without the browser bars. It keeps its own storage, apart from Safari: a wallet created in a Safari tab does not appear in the home screen app, so import its phrase there.
Ghost mode on a phone
Tap the screen with two fingers, anywhere in the app, to blur every balance and address at once. Tap again to show them. See Ghost mode.
Agents on a phone
An agent checks the market on the schedule you set while Ghostdex is open on your screen. Phones pause apps in the background, so when you switch away or lock the phone, the agent waits until you come back. Its ghost still holds only the budget you sent it. See Agents.
How the wallet keeps your key
A new wallet is a standard 12-word recovery phrase (BIP-39), the same kind other wallets use, so you can import it elsewhere later. Ghostdex shows it once and asks you to type two of the words back, to be sure your copy is right.
- The phrase, or an imported private key, is encrypted in the browser with AES-GCM-256. The key comes from your passcode through PBKDF2-SHA256 with 600,000 iterations and a random salt.
- Only the encrypted copy and the public address are stored, under
ghostdex:vaultin this device's storage. Nothing is sent to Ghostdex or to anyone else. - When you unlock, the decrypted key lives in memory only. The wallet locks itself after 15 minutes without a tap, or after the app has been in the background for 5 minutes. You can lock it at any time.
- Showing the phrase again, or removing the wallet from your device, asks for the passcode every time.
The Ghostdex wallet and your ghosts
The Ghostdex wallet can own ghosts like any other wallet. It signs deterministically, so the same recovery phrase opens the same ghosts on any device. Ghost keys are never stored with the encrypted wallet: only the root they come from is kept, in the session storage of the tab that opened them, until that tab closes.
What you confirm
Every transaction and every signature, from the Ghostdex wallet or from a ghost, opens a sheet before anything is signed. It shows the network, the contract with its name when Ghostdex knows it (Universal Router, Permit2, LI.FI, Morpho, Doppler, USDG, a stock token), what the call does, the amount, and the most it can cost in gas. If the chain expects the transaction to fail, the sheet says why and Confirm stays off. Reject returns you to the order with nothing sent.
The one exception is an agent on autopilot: its own ghost signs the orders your rules allow without a sheet. Every other address still asks. See Agents.
Risks
Ghostdex cannot see or recover your recovery phrase. Anyone who has it can take everything in the wallet, and open every ghost it owns. If you lose both the phrase and the passcode, or the phrase and your device, the funds cannot be recovered by anyone.
- A wallet in a browser is as safe as your device: keep it updated, locked, and free of apps you do not trust.
- Clearing this site's data, or uninstalling the app, erases the encrypted wallet from your device. The funds stay on the chain; the phrase brings them back.
- A short passcode is easier to guess if someone copies your device's storage. Use one you do not use elsewhere.
- For large amounts, a hardware wallet connected to Ghostdex on a computer keeps the main key off the internet. Ghost keys are always derived and used in the browser, whatever wallet owns them.